High · published September 4, 2019
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
| Product | Versions | Fixed in |
|---|---|---|
| libexpat_project/libexpat | < 2.2.8 | 2.2.8 |
| python/python | ≥ 2.7.0, < 2.7.17 | 2.7.17 |
| python/python | ≥ 3.5.0, < 3.5.8 | 3.5.8 |
| python/python | ≥ 3.6.0, < 3.6.10 | 3.6.10 |
| python/python | ≥ 3.7.0, < 3.7.5 | 3.7.5 |